VulnCrest
Search
Create account
Report an incident
Radar sectionsDatabase
Check my site

CWE-269Vulnerability type

WordPress Privilege Escalation vulnerabilities (page 1329)

Bugs that let a low-privileged or anonymous user become an administrator, usually through registration or profile updates.

Severity
Signals
Software

41,172 results

The VulnCrest analysis badge marks vulnerabilities we reproduced in our lab, with proof of execution.

WordPress Privilege Escalation vulnerabilities (page 1329)
SeverityVulnerabilityCVEInstallsPublished
Medium5.4Cross-Site Request Forgery to Cross-Site Scripting
bookmarkify≤1.1.3No patch available
CVE-2015-9441—
Medium6.1Cross-Site Request Forgery to Cross-Site Scripting
Monetize≤1.03No patch available
CVE-2015-9440—
Medium6.5Cross-Site Scripting
Avenir-soft Direct Download≤1.0No patch available
CVE-2015-9442—
Medium6.1Reflected Cross-Site Scripting
Qtranslate Slug≤1.1.16Update to 1.1.17
CVE-2015-10092—
Medium6.1< 0.7.23 - Stored Cross-Site Scripting
Job Manager<0.7.23Update to 0.7.23
CVE-2015-2321—
Medium5.3Timing Side-Channel Attack
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5730—
Medium5.5Cross-Site Scripting via Widget Title
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5732—
Critical9.6Cross-Site Request Forgery to Post Lockage
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5731—
Medium6.1Cross-Site Scripting in Theme Preview
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5734—
High8.8SQL Injection
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-2213—
Medium5.4Stored Cross-Site Scripting via accessibility-helper Title
WordPress≤4.2.3Update to 3.7.10 or 3.8.10 or 3.9.8 or 4.0.7 or 4.1.7 or 4.2.4
CVE-2015-5733—
Medium6.1Reflected Cross-Site Scripting
YITH Maintenance Mode≤1.1.4Update to 1.2.0
CVE-2015-9429—
Medium6.5Remote File Download
Simple Image Manipulator≤1.0No patch available
CVE-2015-1000010—
Medium5.5Authenticated (Admin+) Cross-Site Scripting
Content Grabber≤1.0No patch available
CVE-2015-9469—
Medium6.1Cross-Site Scripting
qTranslate≤2.5.39No patch available
CVE-2015-5535—
Medium6.1Cross-Site Scripting
The Holiday Calendar<1.11.3Update to 1.11.3
CVE-2015-9270—
Medium6.1Reflected Cross-Site Scripting
Flickr Justified Gallery<3.4.0Update to 3.4.0
CVE-2015-9327—
Medium6.1Reflected Cross-Site Scripting
Clean Login≤1.5Update to 1.5.1
CVE-2015-9336—
High8.8Cross-Site Request Forgery & Authenticated SQL Injection
Unite Gallery Lite≤1.4.6Update to 1.5
CVE-2015-9445—
High8.8SQL Injection
Unite Gallery Lite<1.5Update to 1.5
CVE-2015-9446—
High7.2Cross-Site Request Forgery and SQL Injection
Unite Gallery Lite<1.5Update to 1.5
CVE-2015-9447—
Medium6.5Authorization Bypass
WordPress≤4.2.2Update to 3.7.9 or 3.8.9 or 3.9.7 or 4.0.6 or 4.1.6 or 4.2.3
CVE-2015-5623—
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
WordPress≤4.2.2Update to 3.7.9 or 3.8.9 or 3.9.7 or 4.0.6 or 4.1.6 or 4.2.3
CVE-2015-5622—
High8.8Authenticated SQL Injection
SendPress Newsletters<1.2Update to 1.2
CVE-2015-9448—
High7.2Authenticated Blind SQL Injection
Microblog Poster – Auto Publish on Social Media<1.6.2Update to 1.6.2
CVE-2015-9449—
High7.2Cross-Site Request Forgery
Count per Day<3.4.1Update to 3.4.1
CVE-2015-5533—
Medium6.1Multiple Cross-Site Scripting
Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions<1.8.4.3Update to 1.8.4.3
CVE-2015-5532—
Medium6.1Cross-Site Scripting
SlimStat Analytics – Real-Time Stats, Heatmaps & Ecommerce<4.1.6.1Update to 4.1.6.1
CVE-2015-9273—
Medium6.3Cross-Site Request Forgery
Portfolio Plugin<1.05Update to 1.05
CVE-2015-6523—
High7.5Sensitive Information Exposure
WordPress Mobile Pack – Mobile Plugin for Progressive Web Apps & Hybrid Mobile Apps<2.1.3Update to 2.1.3
CVE-2015-9269—

Search VulnCrest Radar

Jump to

Are you sure?